Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

> We think the issue might not be severe enough [...]

It might not? In other words, if a security vulnerability is reported, assume everything is actually fine until proven exploitable beyond any shadow of a doubt?



sort by: page size:

> All the really bad security vulnerabilities were obvious.

All the really bad security vulnerabilities that were found were obvious?

One is more likely to find things that are obvious?


> If security is a concern

At the risk of being presumptuous... When is security ever not a concern?


> it is not necessarily

Sure, but labeling a site as “Possibly not secure” wouldn’t be a very effective way of communicating the risks to users.


> That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assumption.

It's absolutely unreasonable.

If my endpoint is compromised, should I assume my key is potentially violated, and so change it? Yes

But should I assume that everything in my life is tainted and therefore pre-emptively expose all my secrets to attackers immediately? Of course not.


>and not breached

Bit of an ideal conditions assumption.

If security isn’t breached then you by definition don’t have a security issue


>> We always have to assume worst case for security vulnerabilities, it's kind of the whole job of being a security researcher to determine what could have happened.

Many people will be annoyed by this "assume the worst" drama.

For example, drinking too much water, if we assume the worst, can kill you.

Also, walking around can kill you, if we assume the worst.

Also, just being around can kill you, if we assume the worst, hey, you could die of a stroke.

So, how is this "assume the worst" statement useful?


> You're offering hypothetical, worst-case whataboutisms

Otherwise known as “security”, yes


> I don't understand what would make someone think that possibly-compromised security is worse than no security.

False sense of security - you think your communications are secure but they're not.


"When a site is brought down, it is often vulnerable to further security breaches."

what? I'd say it's just the other way around


"If it says Not Secure, it's definitely not secure. If it doesn't say that, it's probably not secure anyway."

> when can you claim something as secure?

here’s a maybe wild take, uh, never?


> We already assume the network is insecure.

Maybe naively, I wish this assumption became universal.


Yeah. Don't say:

  This plane has <security vulnerability> ... shall we play with it and do <bad thing>?
It's just asking for trouble.

On the other hand, maybe this would go down better:

  Oh god, this plane has <security vulnerability>. That does not make me feel safe. What if someone did <bad thing>? D:

Yup.

"This almost certainly doesn’t have any security impact, but I’m happy(ish) to be proved wrong."

There's a few words I'd remove from that sentence, I guess.


> you can be certain

To be precise: If it works as described, it makes it (a little? substantially? orders of magnitude?) more difficult for third parties to modify the code.

"Certain" is not a word used in security, IME.


> How is that the most reasonable approach?

The reasonable approach is to be overly cautious. A false sense of security is worse than no security at all.


> No, he means what do you find unusual about it

> It seems like a big security hole.


> When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality.

No you don't. You definitely don't want to assume otherwise and you spend the time derisking and investigating, but if you have zero evidence to support the situation you don't just consider it the case anyways.


They admit they do not have enough information to determine the cause, yet they suggest there is little security risk. They can either not know or not know, but not both at the same time.

At least that is how I understand the statement.

next

Legal | privacy